News and Insights

Practical updates on AI governance, workforce strategy, and digital resilience for EU organisations
Denmark wants consent for deepfakes Why AI-Assisted Attacks Go Through The Side Door AMD plans its chip supply further ahead An AI Savings Target Is A Promise, Not A Result Spotting AI-Generated Scams Is The Wrong Defence Copyright and AI: Brussels asks again BNP’s Google deal has a data boundary EDPB: a fine unless the breach is minor The KIDS Act gates AI chatbots

Stay ahead of AI change. Get practical updates from Future Prep direct to your inbox.

By subscribing you agree to receive Future Prep news. Unsubscribe any time.

Latest Insights

From the Future Prep blog

AI Generated - Two near-identical bound volumes set slightly out of alignment, illustrating Canada's privacy reform diverging from the GDPR.

Canada’s Privacy Reform: Familiar on the Surface, Divergent Underneath

Canada has tabled Bill C-36, a GDPR-style privacy overhaul. For organisations already under European rules it reads as convergence but works as divergence: a second regulator, second thresholds and a second set of rights to map across adequacy, automated decisions and transfers.
AI Generated - A dark secure gallery with four progressively protected bays and a single procurement dossier in the foreground representing graded sovereignty assessment.

CADA’s Four Sovereignty Levels Change How You Buy Cloud and AI

CADA defines four assurance levels for cloud and AI sovereignty, up to EU ownership at Level 3 and full supply-chain control at Level 4. The proposal is not law yet, but the levels already work as a scoring frame. Five procurement and due diligence changes to make this quarter.
AI Generated - Overhead view of a dark boardroom table with a loose folder and papers on the left, a strict four-tier document stack on the right, and a central diagram sheet connecting both sides.

Transatlantic AI Governance: Two Philosophies, One Control Map

In one week the US chose voluntary, standards-referenced AI oversight while the EU adopted CADA's graded sovereignty test. A deployer operating across both cannot run on a single mental model. Here is one control map, with two triggers per control, that answers the European and American regimes at once.
AI Generated - An engineer alone bears the full weight of building AI in-house, with supplier crates left unused behind.

So You Decided to Build. Now You Have to Govern It.

The moment you move from buyer to builder, provider obligations, auditability, logging and exit discipline become yours. Here is how a mid-market organisation keeps a proprietary or co-developed AI tool governable, without a large-firm budget, and where the Cyber Resilience Act starts to bite.
AI Generated - AI confidentiality risk shown as private desk notes exposed to a hidden public gallery through one-way glass.

The AI Confidentiality Risk Hiding in Your Everyday Tools

Two US rulings show that material run through public AI tools can lose privilege and confidentiality. For EU practitioners, contract terms, deployment environment and acceptable-use rules are the controls that decide whether sensitive work stays protected before the next dispute.
AI Generated - Single sheet ruled into six fields with a magnifying glass and an open leather volume beside it, illustrating the Annex III classification memo against the Commission's draft guidelines

Annex III Classification: 6 Critical Fields

The Commission's draft guidelines of 19 May 2026 set worked examples across all eight Annex III categories. The Annex III classification memo now has an external benchmark. Six fields make the call defensible before the 23 June consultation closes.

Latest News

Short updates

Denmark wants consent for deepfakes

Denmark’s culture minister introduced a bill on 8 October to ban sharing realistic digital imitations of a person’s appearance or voice without consent. Performers’ work is covered too, and satire stays allowed. The minister hopes it takes effect at the turn of the year. For anyone generating synthetic voices or faces, the question moves from whether output is labelled to whose likeness it uses, and who agreed to that.

AMD plans its chip supply further ahead

AMD will substantially increase chip supply in 2027 and now plans three to five years ahead, chief executive Lisa Su told reporters in Taipei on 6 October. Demand still exceeds supply, AMD needs more advanced wafer capacity and Su called Taiwan critical to the chip supply chain. An AI roadmap set a year at a time quietly assumes that capacity will be there. How far ahead does yours look?

Copyright and AI: Brussels asks again

On 29 September the European Commission opened a consultation on how technology, AI included, affects copyright protection. The use of protected content in AI is one of four focus areas. Rights holders, generative AI providers and other AI value-chain actors are among those invited to respond until 3 November 2026. An organisation deploying generative AI arguably sits in that chain. Is its view on licensing better heard now, or after any new measures take shape?

BNP’s Google deal has a data boundary

BNP Paribas has signed a five-year Google Cloud partnership covering infrastructure, Gemini models and internal AI agents. It is not a wholesale move. The bank’s existing governance framework decides which data may run in public cloud, and certain categories will stay out. Each agent is to be limited to the resources its task needs. For an EU-operating organisation, the question is whether that boundary is drawn before the contract or after it.

EDPB: a fine unless the breach is minor

The EDPB has adopted guidelines setting a five-step test for when a data protection authority should fine rather than reprimand. Step four carries the weight. A minor infringement generally draws a reprimand, while a non-minor one brings a strong presumption that a fine follows. For an EU-operating organisation, the live question moves from whether a fine is likely to whether its own breach would count as minor. Consultation runs to 13 November.

The KIDS Act gates AI chatbots

The Commission’s KIDS Act proposal, adopted on 17 September, would stop AI companions and chatbots reaching the market until providers can demonstrate compliance and run a monitoring mechanism for emerging risks. Enforcement rides on the AI Act for chatbots and the DSA for platforms, with fines up to 6% of worldwide turnover. For anyone shipping a chatbot that minors can reach, that is a market gate rather than a conduct rule.

Scroll to Top